@sneekin/sdk 1.0.0 → 1.1.0

package/dist/messages/client.d.ts

@@ -0,0 +1,15 @@
+import type { GetMessageResponse, SendMessage, SendMessageResponse } from '../core/generated/api.js';
+import { SneekApiError, type SneekClientOptions } from '../core/index.js';
+export type SneekMessagesClientOptions = SneekClientOptions;
+export interface SendMessageOptions {
+    idempotencyKey?: string;
+}
+/** Typed access to the Sneek message send and delivery-status APIs. */
+export declare class SneekMessagesClient {
+    private readonly client;
+    constructor(options: SneekMessagesClientOptions);
+    send(input: SendMessage, options?: SendMessageOptions): Promise<SendMessageResponse>;
+    get(id: string): Promise<GetMessageResponse>;
+}
+export { SneekApiError };
+export default SneekMessagesClient;

package/dist/messages/index.cjs

@@ -22,6 +22,7 @@ var messages_exports = {};
 __export(messages_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
+  SneekMessagesClient: () => SneekMessagesClient,
   deriveKeys: () => deriveKeys
 });
 module.exports = __toCommonJS(messages_exports);
@@ -142,9 +143,28 @@ function deriveKeys(apiKey) {
     proofKey: derive(KEY_LABELS.proofKey)
   };
 }
+
+// src/messages/client.ts
+var SneekMessagesClient = class {
+  client;
+  constructor(options) {
+    this.client = new SneekClient(options);
+  }
+  send(input, options = {}) {
+    const headers = options.idempotencyKey ? { "Idempotency-Key": options.idempotencyKey } : void 0;
+    return this.client.request("POST", "/api/messages/send", input, headers);
+  }
+  get(id) {
+    return this.client.request(
+      "GET",
+      `/api/messages/${encodeURIComponent(id)}`
+    );
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SneekApiError,
   SneekClient,
+  SneekMessagesClient,
   deriveKeys
 });

package/dist/messages/index.d.ts

@@ -1 +1,2 @@
 export * from '../core/index.js';
+export * from './client.js';

package/dist/messages/index.js

@@ -114,8 +114,27 @@ function deriveKeys(apiKey) {
     proofKey: derive(KEY_LABELS.proofKey)
   };
 }
+
+// src/messages/client.ts
+var SneekMessagesClient = class {
+  client;
+  constructor(options) {
+    this.client = new SneekClient(options);
+  }
+  send(input, options = {}) {
+    const headers = options.idempotencyKey ? { "Idempotency-Key": options.idempotencyKey } : void 0;
+    return this.client.request("POST", "/api/messages/send", input, headers);
+  }
+  get(id) {
+    return this.client.request(
+      "GET",
+      `/api/messages/${encodeURIComponent(id)}`
+    );
+  }
+};
 export {
   SneekApiError,
   SneekClient,
+  SneekMessagesClient,
   deriveKeys
 };

package/dist/verify/approval-store.d.ts

@@ -0,0 +1,22 @@
+export interface SneekQrSession {
+    ref: string;
+    applicationId: string;
+    origin: string;
+    bindingProofHash: string;
+    expiresAt: number;
+    requestId?: string;
+}
+export interface SneekQrApprovalEvent {
+    type: 'qr.approved';
+    applicationId: string;
+    ref: string;
+    requestId: string;
+}
+export interface SneekApprovalStore {
+    createQrSession(session: SneekQrSession): Promise<void>;
+    /** Atomically attach only the first matching approval to a live QR session. */
+    recordQrApproval(event: SneekQrApprovalEvent, now: number): Promise<'recorded' | 'duplicate' | 'missing'>;
+    readQrSession(ref: string): Promise<SneekQrSession | null>;
+    /** Atomically claim a token jti until its exp time; false means replay. */
+    claimJti(jti: string, expiresAt: number): Promise<boolean>;
+}

package/dist/verify/auth-schema.d.ts

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+export declare const QrWebhookEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"qr.approved">;
+    applicationId: z.ZodString;
+    ref: z.ZodString;
+    requestId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "qr.approved";
+    requestId: string;
+    ref: string;
+    applicationId: string;
+}, {
+    type: "qr.approved";
+    requestId: string;
+    ref: string;
+    applicationId: string;
+}>;
+export declare const SneekVerifyActionSchema: z.ZodUnion<[z.ZodObject<{
+    action: z.ZodLiteral<"config">;
+}, "strict", z.ZodTypeAny, {
+    action: "config";
+}, {
+    action: "config";
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"request">;
+    identifier: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "request";
+    identifier: string;
+}, {
+    action: "request";
+    identifier: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"switch">;
+    requestId: z.ZodString;
+    channel: z.ZodEnum<["sms", "whatsapp", "email", "push"]>;
+    proof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "switch";
+    requestId: string;
+    channel: "email" | "sms" | "whatsapp" | "push";
+    proof: string;
+}, {
+    action: "switch";
+    requestId: string;
+    channel: "email" | "sms" | "whatsapp" | "push";
+    proof: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"verify">;
+    requestId: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    proof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "verify";
+    requestId: string;
+    proof: string;
+    code?: string | undefined;
+}, {
+    action: "verify";
+    requestId: string;
+    proof: string;
+    code?: string | undefined;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"verify">;
+    requestId: z.ZodString;
+    ref: z.ZodString;
+    bindingProof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "verify";
+    requestId: string;
+    ref: string;
+    bindingProof: string;
+}, {
+    action: "verify";
+    requestId: string;
+    ref: string;
+    bindingProof: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"create">;
+}, "strict", z.ZodTypeAny, {
+    action: "create";
+}, {
+    action: "create";
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"status">;
+    ref: z.ZodString;
+    bindingProof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "status";
+    ref: string;
+    bindingProof: string;
+}, {
+    action: "status";
+    ref: string;
+    bindingProof: string;
+}>]>;
+export type SneekVerifyAction = z.infer<typeof SneekVerifyActionSchema>;

package/dist/verify/handler.d.ts

@@ -0,0 +1,41 @@
+import type { SneekApprovalStore } from './approval-store.js';
+export interface SneekVerifyHandlerOptions {
+    apiUrl: string;
+    apiKey: string;
+    allowedOrigins: string[];
+    approvalStore: SneekApprovalStore;
+    onVerified: (result: {
+        identifier: string;
+        kind: 'email' | 'mobile';
+        method: string;
+        verifiedAt: string;
+        requestId: string;
+    }) => void | Promise<void>;
+    fetch?: typeof fetch;
+}
+export declare class SneekVerifyHandler {
+    private readonly client;
+    private readonly allowedOrigins;
+    private readonly keys;
+    private readonly approvalStore;
+    private readonly onVerified;
+    private readonly jwksByIssuer;
+    constructor(options: SneekVerifyHandlerOptions);
+    handle(request: Request): Promise<Response>;
+    handleWebhook(request: Request): Promise<Response>;
+    private getAllowedOrigin;
+    private config;
+    private startVerification;
+    private switchVerification;
+    private verify;
+    private verifiedClaims;
+    private startResponse;
+    private createProof;
+    private isValidProof;
+    private createQr;
+    private qrStatus;
+    private qrSession;
+    private partnerConfig;
+    private isValidWebhookSignature;
+    private hash;
+}

package/dist/verify/index.cjs

@@ -22,6 +22,7 @@ var verify_exports = {};
 __export(verify_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
+  SneekVerifyHandler: () => SneekVerifyHandler,
   deriveKeys: () => deriveKeys
 });
 module.exports = __toCommonJS(verify_exports);
@@ -142,9 +143,329 @@ function deriveKeys(apiKey) {
     proofKey: derive(KEY_LABELS.proofKey)
   };
 }
+
+// src/verify/handler.ts
+var import_node_crypto2 = require("crypto");
+var import_jose = require("jose");
+
+// src/verify/auth-schema.ts
+var import_zod = require("zod");
+var BrowserProof = import_zod.z.string().min(1).max(4096);
+var VerificationId = import_zod.z.string().uuid();
+var QrReference = import_zod.z.string().regex(/^[0-9a-f]{64}$/);
+var ConfigActionSchema = import_zod.z.object({ action: import_zod.z.literal("config") }).strict();
+var RequestActionSchema = import_zod.z.object({
+  action: import_zod.z.literal("request"),
+  identifier: import_zod.z.string().min(3).max(254)
+}).strict();
+var SwitchActionSchema = import_zod.z.object({
+  action: import_zod.z.literal("switch"),
+  requestId: VerificationId,
+  channel: import_zod.z.enum(["sms", "whatsapp", "email", "push"]),
+  proof: BrowserProof
+}).strict();
+var VerifyCodeActionSchema = import_zod.z.object({
+  action: import_zod.z.literal("verify"),
+  requestId: VerificationId,
+  code: import_zod.z.string().min(4).max(12).optional(),
+  proof: BrowserProof
+}).strict();
+var VerifyQrActionSchema = import_zod.z.object({
+  action: import_zod.z.literal("verify"),
+  requestId: VerificationId,
+  ref: QrReference,
+  bindingProof: BrowserProof
+}).strict();
+var CreateQrActionSchema = import_zod.z.object({ action: import_zod.z.literal("create") }).strict();
+var QrStatusActionSchema = import_zod.z.object({
+  action: import_zod.z.literal("status"),
+  ref: QrReference,
+  bindingProof: BrowserProof
+}).strict();
+var QrWebhookEventSchema = import_zod.z.object({
+  type: import_zod.z.literal("qr.approved"),
+  applicationId: import_zod.z.string().uuid(),
+  ref: QrReference,
+  requestId: VerificationId
+}).strict();
+var SneekVerifyActionSchema = import_zod.z.union([
+  ConfigActionSchema,
+  RequestActionSchema,
+  SwitchActionSchema,
+  VerifyCodeActionSchema,
+  VerifyQrActionSchema,
+  CreateQrActionSchema,
+  QrStatusActionSchema
+]);
+
+// src/verify/handler.ts
+var SneekVerifyHandler = class {
+  client;
+  allowedOrigins;
+  keys;
+  approvalStore;
+  onVerified;
+  jwksByIssuer = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.client = new SneekClient({
+      apiUrl: options.apiUrl,
+      apiKey: options.apiKey,
+      fetch: options.fetch
+    });
+    this.allowedOrigins = new Set(options.allowedOrigins.map((origin) => new URL(origin).origin));
+    this.keys = deriveKeys(options.apiKey);
+    this.approvalStore = options.approvalStore;
+    this.onVerified = options.onVerified;
+  }
+  async handle(request) {
+    const origin = this.getAllowedOrigin(request);
+    if (request.method !== "POST" || !origin) {
+      return jsonResponse({ error: "Forbidden" }, 403);
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return jsonResponse({ error: "Invalid JSON body" }, 400);
+    }
+    const action = SneekVerifyActionSchema.safeParse(body);
+    if (!action.success) return jsonResponse({ error: "Invalid auth action" }, 400);
+    switch (action.data.action) {
+      case "config":
+        return this.config(origin);
+      case "request":
+        return this.startVerification(action.data.identifier, origin);
+      case "switch":
+        return this.switchVerification(action.data, origin);
+      case "verify":
+        return this.verify(action.data, origin);
+      case "create":
+        return this.createQr(origin);
+      case "status":
+        return this.qrStatus(action.data.ref, action.data.bindingProof, origin);
+    }
+  }
+  async handleWebhook(request) {
+    if (request.method !== "POST") return jsonResponse({ error: "Invalid webhook" }, 405);
+    const contentLength = Number(request.headers.get("content-length") ?? 0);
+    if (contentLength > 16384) return jsonResponse({ error: "Invalid webhook" }, 413);
+    const signature = request.headers.get("sneek-signature") ?? "";
+    const match = /^t=(\d{1,12}),v1=([A-Za-z0-9_-]{43})$/.exec(signature);
+    if (!match) return jsonResponse({ error: "Invalid webhook signature" }, 401);
+    const timestamp = Number(match[1]);
+    const now = Math.floor(Date.now() / 1e3);
+    if (!Number.isSafeInteger(timestamp) || Math.abs(now - timestamp) > 300) {
+      return jsonResponse({ error: "Expired webhook signature" }, 401);
+    }
+    let body;
+    try {
+      const text = await request.text();
+      if (Buffer.byteLength(text, "utf8") > 16384) return jsonResponse({ error: "Invalid webhook" }, 413);
+      body = JSON.parse(text);
+    } catch {
+      return jsonResponse({ error: "Invalid webhook body" }, 400);
+    }
+    const event = QrWebhookEventSchema.safeParse(body);
+    if (!event.success || !this.isValidWebhookSignature(timestamp, event.data, match[2])) {
+      return jsonResponse({ error: "Invalid webhook signature" }, 401);
+    }
+    const session = await this.approvalStore.readQrSession(event.data.ref);
+    if (!session || session.applicationId !== event.data.applicationId || session.expiresAt <= Date.now()) {
+      return jsonResponse({ error: "Unknown or expired QR approval" }, 401);
+    }
+    const recorded = await this.approvalStore.recordQrApproval(event.data, Date.now());
+    if (recorded === "missing") return jsonResponse({ error: "Unknown or expired QR approval" }, 401);
+    return new Response(null, { status: 204 });
+  }
+  getAllowedOrigin(request) {
+    const origin = request.headers.get("origin");
+    if (!origin || origin === "null") return null;
+    try {
+      const parsed = new URL(origin);
+      return parsed.origin === origin && this.allowedOrigins.has(parsed.origin) && new URL(request.url).origin === parsed.origin ? parsed.origin : null;
+    } catch {
+      return null;
+    }
+  }
+  async config(origin) {
+    const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
+    const enabled = partner.origins.includes(origin);
+    return jsonResponse({
+      origin,
+      enabled,
+      ...enabled ? { applicationId: partner.applicationId } : {}
+    }, 200);
+  }
+  async startVerification(identifier, origin) {
+    const result = await this.client.request("POST", "/api/verify", { identifier });
+    return this.startResponse(result, origin);
+  }
+  async switchVerification(action, origin) {
+    if (!this.isValidProof(action.proof, action.requestId, origin)) {
+      return jsonResponse({ error: "Invalid or expired browser proof" }, 403);
+    }
+    const result = await this.client.request(
+      "POST",
+      `/api/verify/${action.requestId}/switch`,
+      { channel: action.channel }
+    );
+    return this.startResponse(result, origin);
+  }
+  async verify(action, origin) {
+    if ("proof" in action) {
+      if (!this.isValidProof(action.proof, action.requestId, origin)) {
+        return jsonResponse({ error: "Invalid or expired browser proof" }, 403);
+      }
+    } else {
+      const session = await this.qrSession(action.ref, action.bindingProof, origin);
+      if (!session || session.requestId !== action.requestId) {
+        return jsonResponse({ error: "QR approval is not bound to this browser" }, 403);
+      }
+    }
+    const body = "proof" in action && action.code !== void 0 ? { code: action.code } : {};
+    const result = await this.client.request(
+      "POST",
+      `/api/verify/${action.requestId}/check`,
+      body
+    );
+    if (result.status !== "verified") {
+      return jsonResponse({ error: "This verification requires additional account setup" }, 403);
+    }
+    const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
+    let payload;
+    try {
+      const jwks = this.jwksByIssuer.get(partner.issuer) ?? (0, import_jose.createRemoteJWKSet)(new URL("/oauth/jwks", partner.issuer));
+      this.jwksByIssuer.set(partner.issuer, jwks);
+      ({ payload } = await (0, import_jose.jwtVerify)(result.idToken, jwks, {
+        issuer: partner.issuer,
+        audience: partner.clientId
+      }));
+    } catch {
+      return jsonResponse({ error: "Sneek verification token is invalid" }, 502);
+    }
+    const claims = this.verifiedClaims(payload, action.requestId);
+    if (!claims) return jsonResponse({ error: "Sneek verification token is invalid" }, 502);
+    if (!await this.approvalStore.claimJti(claims.jti, claims.expiresAt * 1e3)) {
+      return jsonResponse({ error: "Sneek verification token was already used" }, 401);
+    }
+    const verified = {
+      identifier: claims.identifier,
+      kind: claims.kind,
+      method: claims.method,
+      verifiedAt: new Date(claims.verifiedAt * 1e3).toISOString(),
+      requestId: action.requestId
+    };
+    await this.onVerified(verified);
+    return jsonResponse({ status: "verified", ...verified }, 200);
+  }
+  verifiedClaims(payload, requestId) {
+    const requestClaim = payload.verification_request_id;
+    const issuedAt = payload.auth_time ?? payload.iat;
+    const methods = payload.amr;
+    const email = payload.email;
+    const mobile = payload.phone_number;
+    const hasEmail = typeof email === "string" && payload.email_verified === true;
+    const hasMobile = typeof mobile === "string" && payload.phone_number_verified === true;
+    if (payload.sub !== requestId || requestClaim !== requestId || typeof payload.exp !== "number" || typeof issuedAt !== "number" || typeof payload.jti !== "string" || !payload.jti || !Array.isArray(methods) || methods.length === 0 || methods.some((method) => typeof method !== "string" || !method) || hasEmail === hasMobile) return null;
+    return {
+      identifier: hasEmail ? email : mobile,
+      kind: hasEmail ? "email" : "mobile",
+      method: methods.join(" "),
+      verifiedAt: issuedAt,
+      expiresAt: payload.exp,
+      jti: payload.jti
+    };
+  }
+  startResponse(result, origin) {
+    const expiresAt = Date.parse(result.expiresAt);
+    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+      return jsonResponse({ error: "Verification response is invalid or expired" }, 502);
+    }
+    return jsonResponse({
+      requestId: result.id,
+      channel: result.channel,
+      maskedIdentifier: result.maskedIdentifier,
+      expiresAt: result.expiresAt,
+      ...result.instruction ? { instruction: result.instruction } : {},
+      ...result.alternatives ? { alternatives: result.alternatives } : {},
+      ...result.challengeNumber ? { challengeNumber: result.challengeNumber } : {},
+      proof: this.createProof(result.id, origin, expiresAt)
+    }, 200);
+  }
+  createProof(requestId, origin, expiresAt) {
+    const payload = Buffer.from(JSON.stringify({
+      requestId,
+      origin,
+      expiresAt,
+      nonce: (0, import_node_crypto2.randomBytes)(16).toString("base64url")
+    })).toString("base64url");
+    const signature = (0, import_node_crypto2.createHmac)("sha256", this.keys.proofKey).update(payload).digest("base64url");
+    return `${payload}.${signature}`;
+  }
+  isValidProof(proof, requestId, origin) {
+    const [payload, signature, ...extra] = proof.split(".");
+    if (!payload || !signature || extra.length > 0) return false;
+    const expected = (0, import_node_crypto2.createHmac)("sha256", this.keys.proofKey).update(payload).digest();
+    const actual = Buffer.from(signature, "base64url");
+    if (actual.length !== expected.length || !(0, import_node_crypto2.timingSafeEqual)(expected, actual)) return false;
+    try {
+      const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+      return decoded.requestId === requestId && decoded.origin === origin && typeof decoded.expiresAt === "number" && decoded.expiresAt > Date.now() && typeof decoded.nonce === "string";
+    } catch {
+      return false;
+    }
+  }
+  async createQr(origin) {
+    const partner = await this.partnerConfig();
+    if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
+    const nonce = (0, import_node_crypto2.randomBytes)(32).toString("hex");
+    const ref = (0, import_node_crypto2.createHash)("sha256").update(nonce).digest("hex");
+    const issuedAt = Math.floor(Date.now() / 1e3);
+    const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
+    const bindingProof = (0, import_node_crypto2.randomBytes)(32).toString("base64url");
+    const signature = (0, import_node_crypto2.createHmac)("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    await this.approvalStore.createQrSession({
+      ref,
+      applicationId: partner.applicationId,
+      origin,
+      bindingProofHash: this.hash(bindingProof),
+      expiresAt
+    });
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+  }
+  async qrStatus(ref, bindingProof, origin) {
+    const session = await this.qrSession(ref, bindingProof, origin);
+    if (!session) return jsonResponse({ error: "QR approval is not bound to this browser" }, 403);
+    if (!session.requestId) return jsonResponse({ status: "pending" }, 200);
+    return jsonResponse({ status: "approved", requestId: session.requestId }, 200);
+  }
+  async qrSession(ref, bindingProof, origin) {
+    const session = await this.approvalStore.readQrSession(ref);
+    if (!session || session.origin !== origin || session.expiresAt <= Date.now()) return null;
+    const expected = Buffer.from(session.bindingProofHash, "hex");
+    const actual = Buffer.from(this.hash(bindingProof), "hex");
+    if (expected.length !== actual.length || !(0, import_node_crypto2.timingSafeEqual)(expected, actual)) return null;
+    return session;
+  }
+  async partnerConfig() {
+    return this.client.request("GET", "/api/verify/qr/partner-config");
+  }
+  isValidWebhookSignature(timestamp, event, signature) {
+    const expected = (0, import_node_crypto2.createHmac)("sha256", this.keys.webhookSigningKey).update(["sneek-webhook-v1", String(timestamp), event.type, event.applicationId, event.ref, event.requestId].join("\n")).digest();
+    const actual = Buffer.from(signature, "base64url");
+    return actual.length === expected.length && (0, import_node_crypto2.timingSafeEqual)(expected, actual);
+  }
+  hash(value) {
+    return (0, import_node_crypto2.createHash)("sha256").update(value).digest("hex");
+  }
+};
+function jsonResponse(body, status) {
+  return Response.json(body, { status });
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SneekApiError,
   SneekClient,
+  SneekVerifyHandler,
   deriveKeys
 });

package/dist/verify/index.d.ts

@@ -1 +1,3 @@
 export * from '../core/index.js';
+export * from './approval-store.js';
+export * from './handler.js';

package/dist/verify/index.js

@@ -114,8 +114,328 @@ function deriveKeys(apiKey) {
     proofKey: derive(KEY_LABELS.proofKey)
   };
 }
+
+// src/verify/handler.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/verify/auth-schema.ts
+import { z } from "zod";
+var BrowserProof = z.string().min(1).max(4096);
+var VerificationId = z.string().uuid();
+var QrReference = z.string().regex(/^[0-9a-f]{64}$/);
+var ConfigActionSchema = z.object({ action: z.literal("config") }).strict();
+var RequestActionSchema = z.object({
+  action: z.literal("request"),
+  identifier: z.string().min(3).max(254)
+}).strict();
+var SwitchActionSchema = z.object({
+  action: z.literal("switch"),
+  requestId: VerificationId,
+  channel: z.enum(["sms", "whatsapp", "email", "push"]),
+  proof: BrowserProof
+}).strict();
+var VerifyCodeActionSchema = z.object({
+  action: z.literal("verify"),
+  requestId: VerificationId,
+  code: z.string().min(4).max(12).optional(),
+  proof: BrowserProof
+}).strict();
+var VerifyQrActionSchema = z.object({
+  action: z.literal("verify"),
+  requestId: VerificationId,
+  ref: QrReference,
+  bindingProof: BrowserProof
+}).strict();
+var CreateQrActionSchema = z.object({ action: z.literal("create") }).strict();
+var QrStatusActionSchema = z.object({
+  action: z.literal("status"),
+  ref: QrReference,
+  bindingProof: BrowserProof
+}).strict();
+var QrWebhookEventSchema = z.object({
+  type: z.literal("qr.approved"),
+  applicationId: z.string().uuid(),
+  ref: QrReference,
+  requestId: VerificationId
+}).strict();
+var SneekVerifyActionSchema = z.union([
+  ConfigActionSchema,
+  RequestActionSchema,
+  SwitchActionSchema,
+  VerifyCodeActionSchema,
+  VerifyQrActionSchema,
+  CreateQrActionSchema,
+  QrStatusActionSchema
+]);
+
+// src/verify/handler.ts
+var SneekVerifyHandler = class {
+  client;
+  allowedOrigins;
+  keys;
+  approvalStore;
+  onVerified;
+  jwksByIssuer = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.client = new SneekClient({
+      apiUrl: options.apiUrl,
+      apiKey: options.apiKey,
+      fetch: options.fetch
+    });
+    this.allowedOrigins = new Set(options.allowedOrigins.map((origin) => new URL(origin).origin));
+    this.keys = deriveKeys(options.apiKey);
+    this.approvalStore = options.approvalStore;
+    this.onVerified = options.onVerified;
+  }
+  async handle(request) {
+    const origin = this.getAllowedOrigin(request);
+    if (request.method !== "POST" || !origin) {
+      return jsonResponse({ error: "Forbidden" }, 403);
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return jsonResponse({ error: "Invalid JSON body" }, 400);
+    }
+    const action = SneekVerifyActionSchema.safeParse(body);
+    if (!action.success) return jsonResponse({ error: "Invalid auth action" }, 400);
+    switch (action.data.action) {
+      case "config":
+        return this.config(origin);
+      case "request":
+        return this.startVerification(action.data.identifier, origin);
+      case "switch":
+        return this.switchVerification(action.data, origin);
+      case "verify":
+        return this.verify(action.data, origin);
+      case "create":
+        return this.createQr(origin);
+      case "status":
+        return this.qrStatus(action.data.ref, action.data.bindingProof, origin);
+    }
+  }
+  async handleWebhook(request) {
+    if (request.method !== "POST") return jsonResponse({ error: "Invalid webhook" }, 405);
+    const contentLength = Number(request.headers.get("content-length") ?? 0);
+    if (contentLength > 16384) return jsonResponse({ error: "Invalid webhook" }, 413);
+    const signature = request.headers.get("sneek-signature") ?? "";
+    const match = /^t=(\d{1,12}),v1=([A-Za-z0-9_-]{43})$/.exec(signature);
+    if (!match) return jsonResponse({ error: "Invalid webhook signature" }, 401);
+    const timestamp = Number(match[1]);
+    const now = Math.floor(Date.now() / 1e3);
+    if (!Number.isSafeInteger(timestamp) || Math.abs(now - timestamp) > 300) {
+      return jsonResponse({ error: "Expired webhook signature" }, 401);
+    }
+    let body;
+    try {
+      const text = await request.text();
+      if (Buffer.byteLength(text, "utf8") > 16384) return jsonResponse({ error: "Invalid webhook" }, 413);
+      body = JSON.parse(text);
+    } catch {
+      return jsonResponse({ error: "Invalid webhook body" }, 400);
+    }
+    const event = QrWebhookEventSchema.safeParse(body);
+    if (!event.success || !this.isValidWebhookSignature(timestamp, event.data, match[2])) {
+      return jsonResponse({ error: "Invalid webhook signature" }, 401);
+    }
+    const session = await this.approvalStore.readQrSession(event.data.ref);
+    if (!session || session.applicationId !== event.data.applicationId || session.expiresAt <= Date.now()) {
+      return jsonResponse({ error: "Unknown or expired QR approval" }, 401);
+    }
+    const recorded = await this.approvalStore.recordQrApproval(event.data, Date.now());
+    if (recorded === "missing") return jsonResponse({ error: "Unknown or expired QR approval" }, 401);
+    return new Response(null, { status: 204 });
+  }
+  getAllowedOrigin(request) {
+    const origin = request.headers.get("origin");
+    if (!origin || origin === "null") return null;
+    try {
+      const parsed = new URL(origin);
+      return parsed.origin === origin && this.allowedOrigins.has(parsed.origin) && new URL(request.url).origin === parsed.origin ? parsed.origin : null;
+    } catch {
+      return null;
+    }
+  }
+  async config(origin) {
+    const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
+    const enabled = partner.origins.includes(origin);
+    return jsonResponse({
+      origin,
+      enabled,
+      ...enabled ? { applicationId: partner.applicationId } : {}
+    }, 200);
+  }
+  async startVerification(identifier, origin) {
+    const result = await this.client.request("POST", "/api/verify", { identifier });
+    return this.startResponse(result, origin);
+  }
+  async switchVerification(action, origin) {
+    if (!this.isValidProof(action.proof, action.requestId, origin)) {
+      return jsonResponse({ error: "Invalid or expired browser proof" }, 403);
+    }
+    const result = await this.client.request(
+      "POST",
+      `/api/verify/${action.requestId}/switch`,
+      { channel: action.channel }
+    );
+    return this.startResponse(result, origin);
+  }
+  async verify(action, origin) {
+    if ("proof" in action) {
+      if (!this.isValidProof(action.proof, action.requestId, origin)) {
+        return jsonResponse({ error: "Invalid or expired browser proof" }, 403);
+      }
+    } else {
+      const session = await this.qrSession(action.ref, action.bindingProof, origin);
+      if (!session || session.requestId !== action.requestId) {
+        return jsonResponse({ error: "QR approval is not bound to this browser" }, 403);
+      }
+    }
+    const body = "proof" in action && action.code !== void 0 ? { code: action.code } : {};
+    const result = await this.client.request(
+      "POST",
+      `/api/verify/${action.requestId}/check`,
+      body
+    );
+    if (result.status !== "verified") {
+      return jsonResponse({ error: "This verification requires additional account setup" }, 403);
+    }
+    const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
+    let payload;
+    try {
+      const jwks = this.jwksByIssuer.get(partner.issuer) ?? createRemoteJWKSet(new URL("/oauth/jwks", partner.issuer));
+      this.jwksByIssuer.set(partner.issuer, jwks);
+      ({ payload } = await jwtVerify(result.idToken, jwks, {
+        issuer: partner.issuer,
+        audience: partner.clientId
+      }));
+    } catch {
+      return jsonResponse({ error: "Sneek verification token is invalid" }, 502);
+    }
+    const claims = this.verifiedClaims(payload, action.requestId);
+    if (!claims) return jsonResponse({ error: "Sneek verification token is invalid" }, 502);
+    if (!await this.approvalStore.claimJti(claims.jti, claims.expiresAt * 1e3)) {
+      return jsonResponse({ error: "Sneek verification token was already used" }, 401);
+    }
+    const verified = {
+      identifier: claims.identifier,
+      kind: claims.kind,
+      method: claims.method,
+      verifiedAt: new Date(claims.verifiedAt * 1e3).toISOString(),
+      requestId: action.requestId
+    };
+    await this.onVerified(verified);
+    return jsonResponse({ status: "verified", ...verified }, 200);
+  }
+  verifiedClaims(payload, requestId) {
+    const requestClaim = payload.verification_request_id;
+    const issuedAt = payload.auth_time ?? payload.iat;
+    const methods = payload.amr;
+    const email = payload.email;
+    const mobile = payload.phone_number;
+    const hasEmail = typeof email === "string" && payload.email_verified === true;
+    const hasMobile = typeof mobile === "string" && payload.phone_number_verified === true;
+    if (payload.sub !== requestId || requestClaim !== requestId || typeof payload.exp !== "number" || typeof issuedAt !== "number" || typeof payload.jti !== "string" || !payload.jti || !Array.isArray(methods) || methods.length === 0 || methods.some((method) => typeof method !== "string" || !method) || hasEmail === hasMobile) return null;
+    return {
+      identifier: hasEmail ? email : mobile,
+      kind: hasEmail ? "email" : "mobile",
+      method: methods.join(" "),
+      verifiedAt: issuedAt,
+      expiresAt: payload.exp,
+      jti: payload.jti
+    };
+  }
+  startResponse(result, origin) {
+    const expiresAt = Date.parse(result.expiresAt);
+    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+      return jsonResponse({ error: "Verification response is invalid or expired" }, 502);
+    }
+    return jsonResponse({
+      requestId: result.id,
+      channel: result.channel,
+      maskedIdentifier: result.maskedIdentifier,
+      expiresAt: result.expiresAt,
+      ...result.instruction ? { instruction: result.instruction } : {},
+      ...result.alternatives ? { alternatives: result.alternatives } : {},
+      ...result.challengeNumber ? { challengeNumber: result.challengeNumber } : {},
+      proof: this.createProof(result.id, origin, expiresAt)
+    }, 200);
+  }
+  createProof(requestId, origin, expiresAt) {
+    const payload = Buffer.from(JSON.stringify({
+      requestId,
+      origin,
+      expiresAt,
+      nonce: randomBytes(16).toString("base64url")
+    })).toString("base64url");
+    const signature = createHmac("sha256", this.keys.proofKey).update(payload).digest("base64url");
+    return `${payload}.${signature}`;
+  }
+  isValidProof(proof, requestId, origin) {
+    const [payload, signature, ...extra] = proof.split(".");
+    if (!payload || !signature || extra.length > 0) return false;
+    const expected = createHmac("sha256", this.keys.proofKey).update(payload).digest();
+    const actual = Buffer.from(signature, "base64url");
+    if (actual.length !== expected.length || !timingSafeEqual(expected, actual)) return false;
+    try {
+      const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+      return decoded.requestId === requestId && decoded.origin === origin && typeof decoded.expiresAt === "number" && decoded.expiresAt > Date.now() && typeof decoded.nonce === "string";
+    } catch {
+      return false;
+    }
+  }
+  async createQr(origin) {
+    const partner = await this.partnerConfig();
+    if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
+    const nonce = randomBytes(32).toString("hex");
+    const ref = createHash("sha256").update(nonce).digest("hex");
+    const issuedAt = Math.floor(Date.now() / 1e3);
+    const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
+    const bindingProof = randomBytes(32).toString("base64url");
+    const signature = createHmac("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    await this.approvalStore.createQrSession({
+      ref,
+      applicationId: partner.applicationId,
+      origin,
+      bindingProofHash: this.hash(bindingProof),
+      expiresAt
+    });
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+  }
+  async qrStatus(ref, bindingProof, origin) {
+    const session = await this.qrSession(ref, bindingProof, origin);
+    if (!session) return jsonResponse({ error: "QR approval is not bound to this browser" }, 403);
+    if (!session.requestId) return jsonResponse({ status: "pending" }, 200);
+    return jsonResponse({ status: "approved", requestId: session.requestId }, 200);
+  }
+  async qrSession(ref, bindingProof, origin) {
+    const session = await this.approvalStore.readQrSession(ref);
+    if (!session || session.origin !== origin || session.expiresAt <= Date.now()) return null;
+    const expected = Buffer.from(session.bindingProofHash, "hex");
+    const actual = Buffer.from(this.hash(bindingProof), "hex");
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;
+    return session;
+  }
+  async partnerConfig() {
+    return this.client.request("GET", "/api/verify/qr/partner-config");
+  }
+  isValidWebhookSignature(timestamp, event, signature) {
+    const expected = createHmac("sha256", this.keys.webhookSigningKey).update(["sneek-webhook-v1", String(timestamp), event.type, event.applicationId, event.ref, event.requestId].join("\n")).digest();
+    const actual = Buffer.from(signature, "base64url");
+    return actual.length === expected.length && timingSafeEqual(expected, actual);
+  }
+  hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+  }
+};
+function jsonResponse(body, status) {
+  return Response.json(body, { status });
+}
 export {
   SneekApiError,
   SneekClient,
+  SneekVerifyHandler,
   deriveKeys
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sneekin/sdk",
-    "version": "1.0.0",
+    "version": "1.1.0",
     "publishConfig": {
         "access": "public"
     },